Even on iOS it's possible to bypass certificate pinning by using a jailbroken device and tool. I wouldn't say that's a good meassure against reverse engineering.
Reverse Engineering Native Apps by Intercepting Network Traffic
51–60 of 76 posts
Re: Reverse Engineering Native Apps by Intercepting Network Traffic
#52That's what I call debug mode enabled in production. RESTful JSON APIs are truly in debug mode in production
What would you recommend in place of RESTful JSON API's?
Re: Reverse Engineering Native Apps by Intercepting Network Traffic
#53For those looking for a fully native experience, give https://interceptapp.xyz a try. Currently in alpha. Feedback is welcome and appreciated.
Disclosure: I'm the developer.
Re: Reverse Engineering Native Apps by Intercepting Network Traffic
#54I had to do this recently and found a great tool for Android for sniffing traffic on the device called Packet Capture. It can even sniff SSL without root permissions by installing a self-signed certificate and running an in-app local VPN proxy. It also had a bunch of other nice features like parsing common protocols, showing the good bits of HTTP, etc. Much nicer than the approach described here (this article is from…
I've been using Packet Capture to get some data I wanted out of an app recently and in the process I started generally snooping around. What I saw disgusts me. First, just how much waste there is in communication - so many requests with so much JSON traffic for no real reason (except maybe laziness). Second - just how much various apps report on you. I've seen everything I could possibly imagine the phone could know…
Usually it's just usage analytics, but the potential for abuse is great because individual data is still sent.
Re: Reverse Engineering Native Apps by Intercepting Network Traffic
#55Let us also mention the great mitmproxy, an open source equivalent to the Charles proxy: https://github.com/mitmproxy/mitmproxy / https://mitmproxy.org/
Another option is Burp Suite (https://portswigger.net/burp/ ) -- ubiquitous in the security world.
Re: Reverse Engineering Native Apps by Intercepting Network Traffic
#56What are some other ways to prevent people from discovering your API endpoints? One terrible idea I just had was creating only one publicly accessible API and then encrypting the actual endpoint in the payload which the server would decrypt and then redirect.
Don't rely on obscurity and obfuscation. Instead build your API in such a way that handing someone the complete documentation would have no negative impact. Assume the client is always compromised. My $0.02
Re: Reverse Engineering Native Apps by Intercepting Network Traffic
#57Seems ignorant not to have a unique Charles certificate
Apparently modern Charles versions have a unique CA generated by each client.
Re: Reverse Engineering Native Apps by Intercepting Network Traffic
#58For those looking for a fully native experience, give https://interceptapp.xyz a try. Currently in alpha. Feedback is welcome and appreciated. Disclosure: I'm the developer.
Nice, I reckon you're targeting the primary 'benefit' sought by MITM'ers. Most of my Android MiTM'ing is because I want to get at the data behind the app. Trying to comprehend some of the crazy, ultra-nested JSON schemas that some app devs use is a PITA.
Just a suggestion: I know you mention it in one of the marketing lines, but it might be worth stating that it's for Mac in the headline (or in the download button). Otherwise people like me, who just breeze past the marketing material to the download link, will waste 6.8MB of your bandwidth (sorry about that...)
Re: Reverse Engineering Native Apps by Intercepting Network Traffic
#59Earlier quoted context omitted.
Data generated on my phone belongs to me. By definition I cannot snoop on myself.
That's what you'd like to think, but the numerous terms & conditions that you've agreed to for your apps means that you're wrong, some data isn't yours.
No, it really doesnt. Terms of service are only legally binding within the law and the EU has already ruled that reverse Engineering software on your own device is just fine.
So I'll happily keep on ignoring those tldrs.
Re: Reverse Engineering Native Apps by Intercepting Network Traffic
#60Wow, this guy has the completely opposite attitude of me. He seems to think it's a bad thing, an attack!, for users to see just what the hell data you're pulling off someone's phone. And, bizarrely, uses an example of an app that essentially stole data from its users. I should be able to see what data an app is sending, and certificate pinning (and ATS according to another comment) kills that. That's not a good thing…
"I should be able to see what data an app is sending..." And you can. There are many ways. Something as simple as 2 socat instances and netsed works great as a quick and dirty but very robust solution. See also sslsplit which will generate certificates on the fly. Anyone who is telling you that you can place complete trust in the use of x509 certificates on the open internet is either naive or dishonest. I think you…
You should read up on how certificate pinning works. Obviously you can still decompile and recompile the app with different certificates baked in but it's a bit more difficult than what you're implying.